Amazon DocumentDB API and interface VPC endpoints (AWS PrivateLink)

You can establish a private connection between your VPC and Amazon DocumentDB API endpoints by creating an interface VPC endpoint. Interface endpoints are powered by AWS PrivateLink.

While Amazon DocumentDB clusters do not require an interface VPC endpoint connection, AWS PrivateLink enables you to privately access Amazon DocumentDB API operations without an internet gateway, NAT device, VPN connection, or AWS Direct Connect connection. Amazon DocumentDB instances in your VPC don't need public IP addresses to communicate with Amazon DocumentDB API endpoints to launch, modify, or terminate database instances and database clusters. Your Amazon DocumentDB instances also don't need public IP addresses to use any of the available Amazon DocumentDB API operations. Traffic between your VPC and Amazon DocumentDB doesn't leave the Amazon network.

Each interface endpoint is represented by one or more elastic network interfaces in your subnets. For more information, see Elastic network interfaces in the Amazon EC2 User Guide.

For more information about VPC endpoints, see Access an AWS service using an interface VPC endpoint in the Amazon Virtual Private Cloud (AWS PrivateLink) User Guide. For more information about Amazon DocumentDB operations, see the Amazon DocumentDB cluster, instance, and resource management API reference.

Considerations for VPC endpoints

Before you set up an interface VPC endpoint for Amazon DocumentDB API endpoints, ensure that you review the interface endpoint prerequisites in the Amazon Virtual Private Cloud (AWS PrivateLink) User Guide.

All Amazon DocumentDB API operations relevant to managing Amazon DocumentDB resources are available from your VPC using AWS PrivateLink.

VPC endpoint policies are supported for Amazon DocumentDB API endpoints. By default, full access to Amazon DocumentDB API operations is allowed through the endpoint. For more information, see Control access to VPC endpoints using endpoint policies in the Amazon Virtual Private Cloud (AWS PrivateLink) User Guide.

Region availability

Amazon DocumentDB API currently supports VPC endpoints in the following AWS Regions:

Creating an interface VPC endpoint for Amazon DocumentDB API

You can create a VPC endpoint for the Amazon DocumentDB API using either the Amazon VPC Console or the AWS Command Line Interface (AWS CLI). For more information, see Access an AWS service using an interface VPC endpoint in the Amazon Virtual Private Cloud (AWS PrivateLink) User Guide.

Create a VPC endpoint for the Amazon DocumentDB API using the service name com.amazonaws.region.rds.

Excluding AWS Regions in China, if you enable private DNS for the endpoint, you can make API requests to Amazon DocumentDB with the VPC endpoint using its default DNS name for the AWS Regions, for example rds.us-east-1.amazonaws.com. For the China (Beijing) and China (Ningxia) AWS Regions, you can make API requests with the VPC endpoint using rds-api---cn-north-1.amazonaws.com.rproxy.goskope.com.cn and rds-api---cn-northwest-1.amazonaws.com.rproxy.goskope.com.cn, respectively.

For more information, see Access an AWS service using an interface VPC endpoint in the Amazon Virtual Private Cloud (AWS PrivateLink) User Guide.

Creating a VPC endpoint policy for Amazon DocumentDB API

You can attach an endpoint policy to your VPC endpoint that controls access to the Amazon DocumentDB API. The policy specifies the following information:

For more information, see Control access to VPC endpoints using endpoint policies in the Amazon Virtual Private Cloud (AWS PrivateLink) User Guide.

Example: VPC endpoint policy for Amazon DocumentDB API actions

The following is an example of an endpoint policy for Amazon DocumentDB API. When attached to an endpoint, this policy grants access to the listed Amazon DocumentDB API actions for all principals on all resources.

{
"Statement":[
      {
         "Principal":"*",
         "Effect":"Allow",
         "Action":[
            "docdb:CreateDBInstance",
            "docdb:ModifyDBInstance",
            "docdb:CreateDBSnapshot"
         ],
         "Resource":"*"
      }
   ]
}

Example: VPC endpoint policy that denies all access from a specified AWS account

The following VPC endpoint policy denies AWS account 123456789012 all access to resources using the endpoint. The policy allows all actions from other accounts.

{
  "Statement": [
    {
      "Action": "*",
      "Effect": "Allow",
      "Resource": "*",
      "Principal": "*"
    },
    {
      "Action": "*",
      "Effect": "Deny",
      "Resource": "*",
      "Principal": { "AWS": [ "123456789012" ] }
     }
   ]
}